为何Meltdown与Spectre漏洞长达近20年未被发现？技术问询

Great question—this is one of those head-scratching "how did this fly under the radar for so long?" topics that reveals just how layered and complex modern CPU design is. Here are the key reasons:

• The focus was elsewhere: For decades, security researchers and developers have mostly zeroed in on software-level vulnerabilities—think buffer overflows, SQL injection, or insecure API usage. Hardware was treated as a "trusted black box"; the idea that fundamental CPU optimizations could be weaponized just didn't cross many people's minds.

• Exploiting these requires cross-domain expertise: Meltdown and Spectre rely on combining two niche, specialized areas: speculative execution (a core CPU performance optimization) and side-channel attacks (like measuring cache access times to infer hidden data). You need deep, hands-on knowledge of both CPU microarchitecture and low-level system security to connect these dots—something that's rare even among seasoned experts.

• CPU implementation details are opaque: CPU manufacturers don't publish full, granular details of their speculative execution logic. These are proprietary optimizations, kept under wraps to maintain competitive edges. Without access to that level of internal documentation, even skilled researchers struggle to spot these kinds of deeply embedded flaws.

• They break long-standing security assumptions: Traditional security models assume strict, unbreakable isolation between user-mode and kernel-mode code, enforced directly by hardware. Meltdown and Spectre exploit the fact that speculative execution lets code "peek" into restricted memory before permissions are fully checked—violating a foundational assumption that had gone unchallenged for years.

• The vulnerabilities are extremely subtle: Unlike a crash or a clear memory leak, the behavior caused by these flaws is barely noticeable. You can't run a standard vulnerability scan and spot them; you need to design specific, complex tests to detect the tiny timing anomalies that signal a potential exploit. Even if someone stumbled on a weird quirk, they'd likely dismiss it as a harmless performance artifact, not a critical security hole.

内容的提问来源于stack exchange，提问作者Adrian Evans